pdurlej/platform

Fork 0

fix(platformctl): make missing plan exit explicit #642

Merged

pdurlej merged 1 commit from codex/m06-explicit-plan-exit into main

2026-05-30 15:52:34 +02:00

codex commented

2026-05-30 15:41:08 +02:00

Collaborator

Canary status: missing - fire canary 3+3 manually before merge

Canary Context Pack

Product story

Make apply-plan failures easier for agents to diagnose by separating missing/null exitCode from other malformed exit values.

What changed

Added explicit fail-closed branches for missing and null plan exitCode.
Added regression tests for both malformed states.

Why it changed

Issue #196 called out that relying only on membership checks made missing/null exitCode less deterministic and less actionable in apply output.

Files touched

control-plane/platformctl/apply.py
control-plane/platformctl/tests/test_apply_phase3.py

Relevant context

#196 PLAN-EXIT-NONE-EXPLICIT-01
M06 apply-pipeline hardening sequence

Runtime evidence

No runtime mutation. Local validation only.

Known constraints

This PR does not change accepted plan states. It only improves malformed-plan diagnostics before runtime gates.

Explicit out-of-scope

No runtime apply.
No Forgejo mutation beyond this PR.
No changes to plan generation.

Requested decision

Approve and merge if checks stay green.

Merge blockers

Tests fail.
Patchwarden finds leaked command/secret material.
Missing/null exitCode no longer fails closed.

Spec sources read

control-plane/platformctl/apply.py - apply-plan validation path.
control-plane/platformctl/tests/test_apply_phase3.py - existing apply-plan state tests.
Forgejo issue #196 - acceptance criteria.

Validation

PYTHONPATH=control-plane control-plane/.venv/bin/python -m pytest control-plane/platformctl/tests/test_apply_phase3.py control-plane/platformctl/tests/test_apply_env_file.py - 84 passed
PYTHONPATH=control-plane control-plane/.venv/bin/python -m platformctl.cli validate all --json - pass

Closes #196

Canary status: missing - fire canary 3+3 manually before merge ## Canary Context Pack ### Product story Make apply-plan failures easier for agents to diagnose by separating missing/null `exitCode` from other malformed exit values. ### What changed - Added explicit fail-closed branches for missing and null plan `exitCode`. - Added regression tests for both malformed states. ### Why it changed Issue #196 called out that relying only on membership checks made missing/null `exitCode` less deterministic and less actionable in apply output. ### Files touched - `control-plane/platformctl/apply.py` - `control-plane/platformctl/tests/test_apply_phase3.py` ### Relevant context - #196 PLAN-EXIT-NONE-EXPLICIT-01 - M06 apply-pipeline hardening sequence ### Runtime evidence No runtime mutation. Local validation only. ### Known constraints This PR does not change accepted plan states. It only improves malformed-plan diagnostics before runtime gates. ### Explicit out-of-scope - No runtime apply. - No Forgejo mutation beyond this PR. - No changes to plan generation. ### Requested decision Approve and merge if checks stay green. ### Merge blockers - Tests fail. - Patchwarden finds leaked command/secret material. - Missing/null `exitCode` no longer fails closed. ## Spec sources read - `control-plane/platformctl/apply.py` - apply-plan validation path. - `control-plane/platformctl/tests/test_apply_phase3.py` - existing apply-plan state tests. - Forgejo issue #196 - acceptance criteria. ## Validation - `PYTHONPATH=control-plane control-plane/.venv/bin/python -m pytest control-plane/platformctl/tests/test_apply_phase3.py control-plane/platformctl/tests/test_apply_env_file.py` - 84 passed - `PYTHONPATH=control-plane control-plane/.venv/bin/python -m platformctl.cli validate all --json` - pass Closes #196

codex added 1 commit

2026-05-30 15:41:08 +02:00

fix(platformctl): make missing plan exit explicit

canary-required / collect-diff (pull_request) Successful in 6s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 6s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 23s

Details

python-ci / Python 3.11 (pull_request) Successful in 46s

Details

python-ci / Python 3.13 (pull_request) Successful in 45s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 26s

Details

python-ci / Python 3.12 (pull_request) Successful in 44s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 5s

Details

canary-required / canary (pull_request) Successful in 15s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 3m14s

Details

base-is-main / guard (pull_request) Successful in 1s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 24s

Details

e57117d036

codex added the

class/security-sensitive

label

2026-05-30 15:41:09 +02:00

codex commented

2026-05-30 15:46:51 +02:00

Author

Collaborator

Patchwarden PR sanity

Status: advisory_findings
PR: 642
Commit: e57117d0368146800a2d58db7ac84c5e48258f62
Security-sensitive label: present
Authority: advisory model review plus deterministic blockers only
3+3 canary: still alive; this does not replace it

Deterministic findings

info sensitive-path-touched Sensitive path touched — control-plane/platformctl/apply.py
- Evidence: control-plane/platformctl/apply.py
- Next: Route through the existing 3+3/risk-tier process; model review remains advisory.

Model reviewers

`global-glm` / `glm-5.1:cloud`

Status: ok
Verdict: OK
Findings: none

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: OK
Findings: none

`redteam` / `kimi-k2.6:cloud`

Status: ok
Verdict: NOT_OK
high Boolean exitCode bypasses numeric validation via Python equality
- Evidence: control-plane/platformctl/apply.py hunk retains the check plan_exit not in (PLAN_EXIT_NO_DRIFT, PLAN_EXIT_DRIFT)immediately after the new null/missing guards. Because Python evaluatesFalse == 0andTrue == 1, a JSON plan containing
- Next: Insert an explicit isinstance(plan_exit, int) guard before the not in tuple check, or validate plan_exit is an integer immediately after extraction.

Policy notes

GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
Auto-merge is not enabled here.

# Patchwarden PR sanity - Status: `advisory_findings` - PR: `642` - Commit: `e57117d0368146800a2d58db7ac84c5e48258f62` - Security-sensitive label: `present` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings - **`info` `sensitive-path-touched`** Sensitive path touched — `control-plane/platformctl/apply.py` - Evidence: `control-plane/platformctl/apply.py` - Next: Route through the existing 3+3/risk-tier process; model review remains advisory. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `redteam` / `kimi-k2.6:cloud` - Status: `ok` - Verdict: `NOT_OK` - **`high`** Boolean exitCode bypasses numeric validation via Python equality - Evidence: `control-plane/platformctl/apply.py hunk retains the check `plan_exit not in (PLAN_EXIT_NO_DRIFT, PLAN_EXIT_DRIFT)` immediately after the new null/missing guards. Because Python evaluates `False == 0` and `True == 1`, a JSON plan containing ` - Next: Insert an explicit `isinstance(plan_exit, int)` guard before the `not in` tuple check, or validate `plan_exit` is an integer immediately after extraction. ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.